[iuyo5678]

Keep Warn as the default: fresh installs and independent upgrades can continue using unpaired local connections. Once an identity has been paired, an unverified connection cannot impersonate it, including after revocation. Unrelated unpaired browsers remain usable. Explicit Required and TrustLocal policies remain available.

Check the persisted browser binding during registration and reuse the existing registry gate for activation, without adding locks, polling or version-based migration rules. Pairing-required diagnostics apply only to strict mode, so an ordinary unpaired disconnect does not incorrectly instruct users to pair.

Regression coverage verifies unpaired use before/after pairing, identity takeover rejection without disturbing the real session, revoked identities, explicit modes, and revocation across automatic-update handover.

Validation across the final stack:

• Rust workspace: 1,020 passed, one existing ignored; formatting and strict Clippy.
• Extension: 3,570 passed, 363 environment-dependent skips; TypeScript, Biome and production build.
• Five real-daemon tests using the current CLI and published 0.4.1; real Chrome for Testing pairing/navigation smoke.
• The 0.4.2 stage independently passed 131 focused tests, three real-daemon tests, typecheck and Biome.

Stack 8/9; base: #430. Review order: #424 → #425 → #426 → #427 → #428 → #429 → #430 → #431 → #432.